Remote patient monitoring (RPM) documentation has to prove five things for every billed month: the patient consented, a practitioner ordered the monitoring, an eligible device was used, enough data came in, and clinical staff spent real, recorded time acting on it. If any one of those is missing from the chart, the claim is exposed, however good the care was.
This guide walks through each record, the mistakes that draw audit attention, and a workflow independent practices can use to keep RPM revenue defensible.
TL;DR
- Get consent, and file it, before any RPM code is entered. A one-day gap between service and signed consent is audit exposure.
- Document the order, the device (including its FDA status), the days of data, and timed, dated activity logs.
- For 99457 and 99458, record the specific clinical decision made in the live interactive communication, not just that a call happened.
- Track who ordered the monitoring and who performed it, because OIG has called for more oversight in exactly this area.
- Check charts before the claim goes out. Fixing a gap pre-submission costs minutes; fixing it after a denial or audit costs far more.
Table of Contents
- Why RPM documentation draws scrutiny
- The documentation every RPM file needs
- The part practices miss: interactive communication
- What changed in 2026
- A monthly RPM documentation checklist
- Building a workflow that holds up
- Our perspective on RPM documentation
- See what your RPM files are leaving behind
- If a payer asks for your RPM records
- FAQ
- Sources
Why RPM documentation draws scrutiny
RPM lets you track a patient's readings from home, such as blood pressure, glucose or weight, and bill for the device data and for the staff time spent managing it. The service is useful, and it has grown quickly. That growth is what regulators noticed.
The HHS Office of Inspector General published a report in September 2024 finding that additional oversight of RPM in Medicare is needed. In August 2025 it followed with a report on 2024 billing, which a legal analysis summarized as pointing to billing patterns that may signal fraud and abuse, including cases where the proper FDA-cleared devices were often never sent.
For an independent practice, the takeaway is practical. Auditors look for the same gaps in every file, so a file that answers those questions up front holds up. For the wider picture of how audits start, see our guide on why practices face OIG audits.
The documentation every RPM file needs
Practice compliance guidance consistently lists the same core records: documented patient consent obtained before billing begins, a valid order, device records showing the device meets the FDA definition of a medical device, and detailed time documentation with date, duration and activity. Here is what each looks like in a chart.
Patient consent
Consent must be signed and filed before the first RPM service is billed. The common failure is enrolling a patient and billing that same month with consent dated afterward. Even a one-day gap creates audit exposure, so the safest design is a hard stop: no RPM charge can be entered until the signed consent is in the record.
The order
The chart should show who ordered monitoring, for which condition, and why monitoring is medically necessary for this patient. Experts note that audit exposure is high when practices fail to track who ordered the monitoring and who performs it under the clinician's NPI. Put the ordering practitioner's name and NPI in the order itself, and keep the order separate from a general visit note so it is easy to find.
The device
The device must meet the FDA definition of a medical device. Practices often forget this, and the fix is simple: keep a reference to the specific device's FDA clearance status, along with its model and the date it was issued to the patient, so an auditor's equipment question is answered immediately. Given that OIG's 2025 analysis flagged cases where proper devices were never sent, a shipment or hand-off record is worth keeping too.
Data days
For CPT 99454, Medicare requires physiologic data to be collected and transmitted on at least 16 days of a 30-day period. That threshold does not apply to the treatment management codes 99457 and 99458, but monitoring there must still be medically reasonable and necessary. Store a count of transmission days per patient per period, not just a raw data feed.
Time logs
To bill 99457 and 99458, you must document at least 20 minutes of care team time in a calendar month, including live interactive communication with the patient or caregiver. Code 99457 covers the first 20 minutes. Code 99458 covers each additional 20-minute increment. Every time entry should carry a date, a duration in minutes and a description of the activity, and time should be logged only for qualifying work.
The part practices miss: interactive communication
Most teams track the 16-day threshold carefully. Fewer document the interactive communication well, and it is a major red flag in audits. A note that says "called patient, reviewed readings" proves a call happened. It does not show clinical work.
The stronger approach is to document active decision-making, meaning how the data changed the care plan. A JAMA Health Forum analysis notes that clinicians hesitate over RPM because of unclear documentation rules and repayment risk, and that rigorous internal protocols plus clearly documented decision-making are the most effective compliance defense.
| Weak entry | Defensible entry |
|---|---|
| "Spoke with patient re: BP." | "10/14, 12 min, RN live call with patient. Home BP averaged above goal for 5 days. Reviewed home technique and medication timing. Escalated to Dr. Lee, who adjusted the dose. Follow-up reading review in 7 days." |
| "Reviewed data, 20 min." | "10/14, 8 min, reviewed 30-day trend in RPM dashboard. Two out-of-range readings flagged. Called patient and documented in the interactive communication note." |
The example entries are illustrations of structure, not templates for clinical content. Your clinicians should write what actually happened.
What changed in 2026
Two new RPM codes took effect January 1, 2026: CPT 99445 for device supply when readings are sent on 2 to 15 days, and CPT 99470 for 10 to 19 minutes of treatment management. Shorter thresholds mean more billable scenarios, and more places for documentation to go wrong. If your team now bills for a 10-minute month, the time log and the interactive communication note need to be just as precise as they are for a 20-minute month. Confirm current payer-specific rules before you bill, because commercial and Medicaid plans differ from Medicare.
If RPM is part of a broader telehealth line, review our telehealth coding compliance checklist so the same standards apply across services. Practices that bill chronic care management for the same patients should also read our guide to chronic care management documentation, since time and conditions can overlap and each service needs its own record.
A monthly RPM documentation checklist
Run this for every enrolled patient, every billing month, before the claim leaves the building.
- Consent: signed, dated before the first billed service, and filed in the chart.
- Order: ordering practitioner, NPI, diagnosis and medical necessity are recorded.
- Device: model, FDA status and issue date are on file.
- Data days: transmission days are counted for the 30-day period, and 16 or more are present if billing 99454.
- Time: each entry has a date, minutes and activity. Time is totaled and meets the code threshold.
- Interactive communication: at least one live exchange with the patient or caregiver is documented each billing month, with the clinical decision recorded.
- Performer: the person who did the work and the supervising practitioner are identifiable.
- Alignment: codes on the claim match what the notes show, no more and no less.
The last item matters in both directions. Over-coding creates audit risk, and under-coding leaves earned revenue unbilled. Our piece on medical coding risk detection explains how both kinds of gap show up in independent practices.
Building a workflow that holds up
Documentation quality is mostly a workflow question, not a training question. Three design choices help.
Let staff work at the top of their license. The AMA's RPM playbook recommends using automated vendor tools to screen data so only clinically relevant data points reach the physician. That reduces physician burden and improves both outcomes and documentation, because each escalation has a reason attached to it.
Gate billing on the record. Consent, order and device fields should be required before an RPM charge can be entered. A rule in the EHR beats a reminder in a meeting.
Protect patient data. RPM moves health data across devices, vendors and networks. Telehealth practices of every specialty face the same privacy duties, and this HIPAA and OCR readiness guide for telepsychiatry shows how one clinical group thinks about staying audit-ready on privacy. Your business associate agreements with device vendors belong in the same file as your RPM policies.
Keep an audit trail as well. If a payer asks who changed a time entry and when, you want the answer in seconds. Our physician's guide to healthcare compliance audit trails covers what to capture.
Our perspective on RPM documentation
We see the same pattern in independent practices. The care is good and the staff is working hard, but the evidence of that work is scattered across a device portal, a time spreadsheet and an EHR note. When a payer asks for proof, someone has to rebuild the month by hand.
We think the answer is to look at the chart before the claim, not after the denial. HIMShield scans EHR data for coding, documentation and charge-capture gaps, quantifies them per provider and per payer, and drafts corrections that a physician can approve with one e-signature. For RPM, that means catching a missing consent date or a thin time entry while it is still a small fix.
The second thing we believe is that physicians should not have to become compliance experts. A good system gives clear, plain guidance at the moment it matters and keeps the rest out of the way. If you want a deeper look at how reviews like this work, read our audit methodology for physician groups.
— Elena
See what your RPM files are leaving behind
Our free 30-day Revenue Leakage Audit reviews your EHR data for coding, documentation and charge-capture gaps and delivers a quantified report by provider and payer. It requires no new staff and no software training, and a performance guarantee comes with it before any paid subscription. You can also learn more about our HIM compliance engagement.
If a payer asks for your RPM records
Start by pulling the full month for the patient in question: consent, order, device record, data days and time log. Check that every item matches what was billed, and correct any internal errors through your normal process rather than editing old notes. Our guide on how to prepare for a payer audit lays out the response steps, and our overview of upcoding audit risk shows what reviewers compare across your claims.
FAQ
What documentation is required for remote patient monitoring billing?
You need documented patient consent obtained before billing, a valid order, records of an FDA-defined medical device, and time documentation with date, duration and activity. For 99454 you also need at least 16 days of data in a 30-day period. For 99457 and 99458 you need at least 20 minutes of care team time in the month, including live interactive communication.
Does the 16-day rule apply to every RPM code?
No. CMS applies the 16-day requirement to 99454, not to treatment management codes 99457 and 99458. Those still require that monitoring be medically reasonable and necessary. New 2026 codes use shorter windows, so check current payer policy for the code you bill.
Can I bill RPM in the month a patient enrolls?
Yes, but only if consent was signed and filed before services began. Billing in the enrollment month without prior-dated consent is a common pitfall. Build a rule so no RPM code can be entered until the consent is on file.
How detailed should the interactive communication note be?
Detailed enough to show a clinical decision. Record the date, minutes, who spoke with the patient, what the data showed and what changed in the plan. A note that only says a call took place is a known audit weak point.
Sources
- OIG: Oversight of Remote Patient Monitoring Needed (LeadingAge)
- OIG Issues Remote Patient Monitoring Report: Billing Pitfalls and Compliance Risks
- RPM Compliance Checklist 2026 (CCNHealth)
- MLN901705: Telehealth and Remote Monitoring (CMS)
- 7-step SMBP quick guide: Coding (AMA)
- Expanding Mental Health Care Access: Remote Therapeutic Monitoring (JAMA Health Forum)
- AMA Remote Patient Monitoring Playbook
- CMS 2026 Final Rule: New RPM CPT Codes 99445 and 99470